CVE-2026-83540 wolfSSHd on Windows race condition leading to logon token reused across connections
A race condition in wolfSSHd on Windows allows less privileged users to hijack logon tokens and gain access as more privileged users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-83540?
CVE-2026-83540 is a high-severity vulnerability in wolfSSL wolfSSH, published on 7 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not released before a token is acquired for a subsequent connection, resulting in user login poisoning between connections. A less privileged user with a valid account on the server can exploit this to force a login as a more privileged user. The vulnerability was introduced with the initial Windows port of wolfSSHd in wolfSSH version 1.4.15 and affects all versions through 1.5.0. Non-Windows builds of wolfSSHd are not affected.
Which versions are affected by CVE-2026-83540?
It affects 1 product.
Products include Wolfssh Wolfssh.
How do I fix CVE-2026-83540?
No fix has been published for CVE-2026-83540 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-83540 being exploited?
There is no known exploitation of CVE-2026-83540 in the wild and no public exploit code.
Other vulnerabilities in wolfSSL wolfSSH
Sources
Also known as GHSA-36jf-xmwg-5wp8.